Is it possible to read/write a file at privilege?

hello.

I saw some systems which were hacked by sql injection tool
And some files of the systems were changed. I guess the tool tried to
read/write files.
howerver, the user privilege is not 'sa'. Is it possible for user who
is not 'sa' to read/write files?

If it is possible, how can I prevent the tools from reading/writing
files even if my web page is injectable?

.